Re: [syzbot] [io-uring?] KMSAN: uninit-value in io_req_task_work_add_remote

[Jens Axboe]

On 7/24/24 12:59 PM, syzbot wrote:
> Hello,
> 
> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
> KMSAN: uninit-value in io_req_task_work_add_remote
> 
> =====================================================
> BUG: KMSAN: uninit-value in io_req_local_work_add io_uring/io_uring.c:1193 [inline]
> BUG: KMSAN: uninit-value in io_req_task_work_add_remote+0x592/0x5e0 io_uring/io_uring.c:1241
>  io_req_local_work_add io_uring/io_uring.c:1193 [inline]
>  io_req_task_work_add_remote+0x592/0x5e0 io_uring/io_uring.c:1241
>  io_msg_remote_post io_uring/msg_ring.c:102 [inline]
>  io_msg_data_remote io_uring/msg_ring.c:133 [inline]
>  io_msg_ring_data io_uring/msg_ring.c:152 [inline]
>  io_msg_ring+0x1c38/0x1ef0 io_uring/msg_ring.c:305
>  io_issue_sqe+0x383/0x22c0 io_uring/io_uring.c:1711
>  io_queue_sqe io_uring/io_uring.c:1925 [inline]
>  io_submit_sqe io_uring/io_uring.c:2181 [inline]
>  io_submit_sqes+0x1259/0x2f20 io_uring/io_uring.c:2296
>  __do_sys_io_uring_enter io_uring/io_uring.c:3206 [inline]
>  __se_sys_io_uring_enter+0x40c/0x3ca0 io_uring/io_uring.c:3143
>  __x64_sys_io_uring_enter+0x11f/0x1a0 io_uring/io_uring.c:3143
>  x64_sys_call+0x2d82/0x3c10 arch/x86/include/generated/asm/syscalls_64.h:427
>  do_syscall_x64 arch/x86/entry/common.c:52 [inline]
>  do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
>  entry_SYSCALL_64_after_hwframe+0x77/0x7f
> 
> Uninit was created at:
>  __alloc_pages_noprof+0x9d6/0xe70 mm/page_alloc.c:4719
>  __alloc_pages_node_noprof include/linux/gfp.h:269 [inline]
>  alloc_pages_node_noprof include/linux/gfp.h:296 [inline]
>  alloc_slab_page mm/slub.c:2321 [inline]
>  allocate_slab+0x203/0x1220 mm/slub.c:2484
>  new_slab mm/slub.c:2537 [inline]
>  ___slab_alloc+0x12ef/0x35e0 mm/slub.c:3723
>  __kmem_cache_alloc_bulk mm/slub.c:4759 [inline]
>  kmem_cache_alloc_bulk_noprof+0x486/0x1330 mm/slub.c:4831
>  __io_alloc_req_refill+0x84/0x560 io_uring/io_uring.c:940
>  io_alloc_req io_uring/io_uring.h:393 [inline]
>  io_submit_sqes+0x171b/0x2f20 io_uring/io_uring.c:2285
>  __do_sys_io_uring_enter io_uring/io_uring.c:3206 [inline]
>  __se_sys_io_uring_enter+0x40c/0x3ca0 io_uring/io_uring.c:3143
>  __x64_sys_io_uring_enter+0x11f/0x1a0 io_uring/io_uring.c:3143
>  x64_sys_call+0x2d82/0x3c10 arch/x86/include/generated/asm/syscalls_64.h:427
>  do_syscall_x64 arch/x86/entry/common.c:52 [inline]
>  do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
>  entry_SYSCALL_64_after_hwframe+0x77/0x7f
> 
> CPU: 0 UID: 0 PID: 5924 Comm: syz.0.16 Not tainted 6.10.0-syzkaller-12268-g7a3fad30fd8b-dirty #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
> =====================================================

#syz test

diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c
index 8e6faa942a6f..198bbbfe465c 100644
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -1164,8 +1164,10 @@ static inline void io_req_local_work_add(struct io_kiocb *req,
 		 * previous adds should've tried to wake the task.
 		 */
 		nr_tw = nr_tw_prev + 1;
+#if 0
 		if (!(flags & IOU_F_TWQ_LAZY_WAKE))
 			nr_tw = IO_CQ_WAKE_FORCE;
+#endif
 
 		req->nr_tw = nr_tw;
 		req->io_task_work.node.next = head;
-- 
Jens Axboe